[plug] POP mail security

[Christian]

John Summerfield wrote:
> > > He also said his concern was people sniffing.
> >
> > Umm... I know.  That's why I recommended APOP, SSH or a Kerberized POP.
> 
> How do APOP or Kerberos enhance protection against packets sniffers?

I've already answered this question.  Quick overview: APOP allows
authentication through exchange of a shared secret through creation of a
message digest based upon the secret and a nonce.  Kerberos uses
symmetric cryptography for authentication and has the capability to
encrypt session traffic.  There are heaps of references on Kerberos if
you care to look and RFC 1725 covers APOP.

Since my previous email on APOP, I've thought about it and come up with
a couple of possible problems.  One is to do with the creation of the
nonce which I read a discussion about on a mailing list.  The second is
that, since user passwords aren't actually stored on the system anywhere
(encrypted or plaintext), I don't see how the authentication mechanism
is going to work since the "shared secret" is only shared by one of the
parties!  The way around this appears to be that plaintext passwords
need to be special maintained on the system for the POP server to
access.

Looking a bit further I found cucipop supports APOP but I haven't had
the opportunity to test it.  It appears to use this feature you need to
use the 'makevpopdb' command although I'd be interested to hear from
anyone who's actually implemented this.

Regards,

Christian.